Monday, August 18, 2014

Today a friend mentioned that they had seen several ASProx messages being distributed by domains
that looked like law firm names warning of court appearances. I was a bit surprised that this
was news to him, as we've been seeing this for some time. I thought it might be interesting
to try to identify when the campaign began.

First, I was fairly certain that the campaign my friend referred to was the "Notice to appear"
spam that we've written about so many times at Malcovery, but this does seem to be a bit
different than the "law firm of the day" notice to appear campaigns we've seen imitating groups
like Green Winick
and many others including Jones Day (jonesday.com), Latham Watkins (lw.com), Hogan Lovells (hoganlovells.com),
McDermitt, Will & Emery (wme.com). Those campaigns were all examples of the ASProx malware.
But how are those different than the "truck lawyer" campaigns? It seemed worth taking a look.

For the month of August 2014, so far the daily count on these spam messages has looked like this:

From June 1, 2014 to August 18, 2014 more than 25,000 different combinations
of the above were used in emails that sent email to the Malcovery Spam Data Mine.

The attached .zip files during that period of time, when unpacked, revealed 39,571 distinct
executables, all of which are variants of the "Kuluoz" or "DoFoil" malware.

Because of the apparent polymorphic nature of many of the samples, where each binary is unique, I've only shared the hashes of the non-polymorphic versions - where the same binary was used many times. If the final column is clickable, the link shows the VirusTotal detection rate at the time of our original reporting.

A recent trend in these file names is that the first character, which looks like the letter "C" is actually the Russian "S", a cyrillic look alike for our "C", expressed with the characters: С (ampersand, pound sign, 1057, semicolon). When the word "Court" is spelled with the Cyrillic S instead, a search for the word "Court" will not find it! Here is the word Court twice, first with a "C" and then with the cyrillic equivalent: Court Сourt